Critical SQL Injection (CVE‑2026‑2413) in Ally WordPress Plugin Threatens 400,000+ Sites
What It Is — The Ally accessibility plugin for WordPress (formerly One Click Accessibility) contains an unauthenticated SQL‑injection flaw (CVE‑2026‑2413). By supplying a crafted URL parameter, an attacker can inject arbitrary SQL into a JOIN clause and retrieve sensitive database records, including password hashes. All versions up to 4.0.3 are vulnerable.
Exploitability — The vulnerability is publicly disclosed, a proof‑of‑concept (time‑based blind injection) has been released, and it carries a CVSS v3.1 score of 7.5 (High). No widespread ransomware‑style campaigns have been observed yet, but exploitation requires only network access and no authentication.
Affected Products — Ally (One Click Accessibility) WordPress plugin, versions ≤ 4.0.3; estimated > 400,000 WordPress sites worldwide.
TPRM Impact —
- Large supply‑chain exposure: any organization that hosts client‑facing WordPress sites or relies on third‑party WordPress implementations inherits this risk.
- Potential credential theft and data leakage across multiple industries, increasing downstream breach liability.
- May affect SaaS platforms that embed WordPress as a content engine, amplifying the attack surface.
Recommended Actions —
- Inventory all WordPress installations and identify sites running the Ally plugin.
- Patch immediately to Ally 4.1.0 (or later) – the only version that mitigates the flaw.
- Validate that the update is applied via automated configuration management tools.
- Run a database integrity check for unexpected modifications or extracted data.
- Deploy WAF rules to block suspicious URL patterns targeting the vulnerable endpoint.
- Update third‑party risk registers to flag Ally as a high‑severity finding and require remediation in vendor contracts.
Source: Security Affairs